Add a "verbose dry-run" mode to display what data is exchanged with OSV.dev

https://github.com/google/osv.dev/discussions/1131 raised some questions rooted in confidentiality/privacy concerns around what information is shared with (and subsequently logged by) OSV.dev infrastructure.

I thought it would be helpful for privacy-conscious users of OSV Scanner to be able to reason about what data is being exchanged with OSV.dev if they could run OSV Scanner in a "verbose dry-run" where the API calls were displayed without sending anything to OSV.dev.